Questions tagged [capabilities]

POSIX Capabilities are a way to split full superuser privileges into smaller partitions of privileges. Use this tag for questions on managing and using capabilities.

Filter by
Sorted by
Tagged with
1 vote
1 answer
43 views

Can two different sets of capabilities be set to one file?

I'd like to set different capabilities to permitted and inherited sets of my file. Something like this: sudo setcap cap_fsetid=ei mybinary sudo setcap cap_kill=ep mybinary However, the latter command ...
user avatar
0 votes
0 answers
31 views

Program cannot acquire the capabilities it needs (raw sockets)

Note: This is partly a programming question, but my gut feeling is that this has more to do with the Linux' security capabilities framework in general, hence posting here instead of StackOverflow. I ...
user avatar
  • 101
1 vote
0 answers
53 views

How does libpcap read network packets, and why can it not operate in some VMs?

I'm interested to learn how libpcap reads network packets, as I am finding it is not possible when running on AWS Lambda From what I can understand, you need either or both of the CAP_NET_ADMIN and ...
user avatar
  • 111
0 votes
0 answers
69 views

How to get list of Linux capabilities

I need to get a list of capabilities available to the version of linux on which the program is executed. Just in order to give user possibility to choose what capability to grant to the file. Is there ...
user avatar
0 votes
1 answer
49 views

Are capabilities per-process or per-thread attributes?

Documentation says that capabilities are per-thread attributes. Indeed in any /proc/[PID]/task/[LWP]/status we can find capabilities, related to this thread: CapInh: 0000000000000000 CapPrm: ...
user avatar
2 votes
1 answer
70 views

How can an unprivileged file have an enabled effective bit? (POSIX capabilities)

I'm trying to understand POSIX-capabilities principles, their transformation during execve() to be more specific. I'll put some quotes from documentation during my question: P'(ambient) = (...
user avatar
1 vote
0 answers
26 views

Is there any tool or method to debug an error about `open fileXXX: Operation not permitted?`

I have a running program trying to open and write to a file under systemd folder: /etc/systemd/system/mysqld_3310.service.d/u_iops_value but got this error: write /etc/systemd/system/mysqld_3310....
user avatar
0 votes
1 answer
46 views

Which actions a non-root process can't do?

Obviously, it can not rwx files that it doesn't have permission to. But I am talking about other "actions", I know of them is binding to ports with lower number than 1024. What else ?
user avatar
  • 147
0 votes
1 answer
36 views

Not able to assign root privilege to my process again by using setuid(0) in the same boot cycle

I have added the capability by using following cmd on terminal (alternative of setting CAP_SETUID in drop-in file). Verified that setuid/seteuid is working. setcap cap_sys_admin,cap_setuid+ep /...
user avatar
0 votes
1 answer
265 views

getpcaps not working in ubuntu 20.04 with linux 5.11.0-38-generic

I saw on StackOverflow https://stackoverflow.com/a/64000118/8507296 to check capabilities of the process using command getpcaps <pid> Output of ps command $ ps PID TTY TIME CMD ...
user avatar
  • 101
0 votes
0 answers
139 views

Getting Wireguard statistics without root

I am writing a simple python webapp for monitoring wireguard VPNs; the data are obtained from the wg-json tool provided with Wireguard, which essentially calls wg show all dump. wg show all ...
user avatar
  • 741
4 votes
2 answers
250 views

Granting Capabilities to a user through PAM doesn't apply to SSH

I am using CentOS 8, and I would like to grant a user the cap_dac_read_search capability though PAM. It seems to work through local login and su, but not through ssh. I followed these steps, and only ...
user avatar
  • 53
2 votes
1 answer
807 views

What is the relation between CAP_NET_RAW and net.ipv4.ping_group_range?

I am using rootless containers, according to the buildah docs, Moreover, pinging from a rootless container does not work because it lacks the CAP_NET_RAW security capability that the ping command ...
user avatar
  • 22.4k
1 vote
3 answers
108 views

Unable to use the `==` argument of `capsh` to re-exec it?

I am experimenting with capsh of libcap2-bin (1:2.32-1), but have found that I'm unable to use the == argument to re-exec capsh. In particular, when I'm using the capsh's == argument, it's complaining ...
user avatar
  • 3,287
1 vote
1 answer
152 views

Why is CAP_CHROOT equivalent to root?

I have trouble understanding the root-equivalence of CAP_CHROOT given the below template. I understand that 1) means to create a directory structure, containing all dependencies (e.g. shared objects), ...
user avatar
  • 3,287
0 votes
1 answer
746 views

How to read /proc/PID/maps without sudo? [duplicate]

I want to read the memory map (/proc/PID/maps) of some process without being sudo. And that is trivial, unless, the process has capabilities. See what I mean: If I run: $ bash $ cat /proc/$$/maps ...
user avatar
0 votes
1 answer
186 views

Do cap_setfcap capability can be used to grant full capabilities to an exe file?

I have a file (let's call it prog) that has the cap_setfcap capabiility. Can I use it to grant prog (the file itself) full capabilities? I know it's not recommended, I just want to know if it can be ...
user avatar
  • 1
2 votes
1 answer
926 views

Why ping works without capability and setuid [duplicate]

I learned from here that there's 2 ways to control privileged activities: setuid and capability. But when I'm playing around with ping on my machine, it seems that it can bypass these 2 mechanism. ...
user avatar
  • 145
1 vote
1 answer
146 views

Linux Security Best practice: CAP_SETFCAP vs sudoer file

I am new to linux securities and tried to understand what's the best practice for linux capabilities. Here is my scenario: I have an executable file (let's call it foo) which needs to grant ...
user avatar
3 votes
1 answer
249 views

How can a process hold a capability in another namespace?

I'm brooding over the interactions between namespaces and capabilities. Occasionally, I stumble over wording like the following from user_namespaces(7): Holding CAP_SYS_ADMIN within the user ...
user avatar
  • 1,011
1 vote
1 answer
1k views

Should I grant sudo to a user or add CAP_SYS_ADMIN capabilities to use nvprof/ncu? And why?

Since CUDA 10.1, users are required to have sudo privileges to collect advanced metrics with cuda profiling tools such as nvprof or nsight compute (ncu). Alternatives to get around it are described ...
user avatar
  • 163
1 vote
1 answer
711 views

Linux capabilities for modifying files owned by root?

Is there any linux capability to enable normal users to write into root owned files like /etc/resolv.conf and /etc/fstab`?
user avatar
14 votes
2 answers
2k views

How does ping work on Fedora without setuid and capabilities?

As far as I know, ping needs to create a raw socket (which needs either root access or cap_net_raw capabilities). From my understanding the trend these last years has been to remove setuid binaries ...
user avatar
1 vote
2 answers
358 views

Does the root user bypass capability checking?

Does the root user bypass capability checking in the kernel, or is the root user subject to capability checking starting with Linux 2.2? May applications check for and deny access for the root user, ...
user avatar
  • 3,287
1 vote
1 answer
190 views

linux capabilities to read environment variables?

I'd like to run a service as a non-privileged user, but it needs to bind to a system port number (i.e. less than 1024), so I give it setcap 'cap_net_bind_service=+ep' <path for service>, all ...
user avatar
12 votes
2 answers
6k views

What is the difference between AmbientCapabilities and CapabilityBoundingSet?

I am trying to create a systemd service for a web server process that has to bind to port 80 and 443. I found some examples setting AmbientCapabilities=CAP_NET_BIND_SERVICE and setting both ...
user avatar
3 votes
2 answers
718 views

Capability inheritable for system() call in C/C++

Currently I'm trying to understand capabilities in Linux by reading http://man7.org/linux/man-pages/man7/capabilities.7.html I created a small C++ application with the capability CAP_DAC_READ_SEARCH+...
user avatar
0 votes
1 answer
104 views

Does "Polkit" make use of linux capabilities?

I know that some authentication programs like KDE's KAuth can use polkit as the backend.And what makes polkit special is that it can grant some specific privileges to a non-privileged process.A ...
user avatar
0 votes
2 answers
663 views

What does capsh --print actually do?

I understand that Linux capabilities are defined on processes/files. But when I do capsh --print, it tells me the capabilities of the user. So what exactly is capsh --print doing? Capabilities are ...
user avatar
  • 101
1 vote
1 answer
912 views

Run openvpn as non-root user

I'm trying to run openvpn server within podman unprivileged container. Openvpn needs to be able to manage network interfaces (i.e. create tun interface, assign IP address to it, bring it up). On my ...
user avatar
  • 121
0 votes
1 answer
159 views

Setting file capabilities in deb package fails

So, there is my piece of software, that has to be distributed via deb-packages, it contains a small custom server. That server requires ability to listen on a priviledged port, because explaining to a ...
user avatar
0 votes
0 answers
229 views

How to setcap wifi-menu on arch for non-root users?

I'm trying to run wifi-menu on arch as non-root. No setcap i've tried works. [root@lilegg johny]# setcap CAP_NET_ADMIN,CAP_SYS_ADMIN,CAP_NET_RAW,CAP_DAC_OVERRIDE=eip /usr/bin/wifi-menu [root@lilegg ...
user avatar
  • 303
4 votes
0 answers
180 views

Is there something like 'sudo' but give only one capability not real root?

I want to run a one-time web server on port 80, which I will never run again. Is there something like 'sudo' that gives only temporary CAP_NET_BIND_SERVICE, not real root, to a process? So that we ...
user avatar
0 votes
1 answer
123 views

Are there some Unix or Unix-like operating systems that still treats the "root" user as the superuser?

Linux does not treat the "root" user as the superuser anymore, but rather Linux uses capabilities which gives a process privileges (I think BSD does a similar thing). So for example in older Linux ...
user avatar
  • 1,153
3 votes
1 answer
131 views

Why is there no "set effective supplementary GIDs" syscall?

The "effecive user/group ID" of a process is what the OS uses to determine whether an action (such as opening a file) is permitted by the process. You can set the effective primary GID of the current ...
user avatar
2 votes
1 answer
363 views

htop - how can I enable the new metrics for "delay accounting"?

htop has some new metrics: PERCENT_CPU_DELAY (CPUD%) The percentage of time spent waiting for a CPU (while runnable). Requires CAP_NET_ADMIN. PERCENT_IO_DELAY (IOD%)...
user avatar
1 vote
0 answers
501 views

Run a single process that can fork and clone as a non-root-user

I wish to run a docker container which runs a single os process, forks a clone of itself through invoking '/proc/self/exe'. This process will be launched by a user of the container, who may be a ...
user avatar
  • 113
11 votes
2 answers
7k views

What does the "ep" capability mean?

root@macine:~# getcap ./some_bin ./some_bin =ep What does "ep" mean? What are the capabilities of this binary?
user avatar
  • 121
1 vote
1 answer
1k views

Capabilities to start a systemd service

I'm starting a process with the cap_kill capability and use this process to kill other services. However I'd like to be able to restart these service with a systemctl restart xxx Is there a ...
user avatar
  • 203
0 votes
1 answer
2k views

setcap binary but with arguments?

I'm trying to start BoringTun with setcap in order for it to run unprivileged but still have the ability to fmark: root@67672793823c:/# setcap cap_net_admin+epi /usr/local/sbin/boringtun --foreground ...
user avatar
  • 35.5k
8 votes
1 answer
14k views

Docker running an app with NET_ADMIN capability: involved risks

I'm trying to run an app in a docker container.The app requires root privileges to run. sudo docker run --restart always --network host --cap-add NET_ADMIN -d -p 53:53/udp my-image My question is: ...
user avatar
5 votes
1 answer
6k views

Why is CAP_NET_ADMIN insufficient permissions for ioctl(TUNSETIFF)?

I'm trying to write a tun/tap program in Rust. Since I don't want it to run as root I've added CAP_NET_ADMIN to the binary's capabilities: $sudo setcap cap_net_admin=eip target/release/tunnel $getcap ...
user avatar
0 votes
0 answers
827 views

Give root's permission to restricted user using PAM and Linux capabilities

I want to give root's permission (or root account) to my test's user not using wheel-group or sudoers on CentOS 7. Instead I would like to use module pam_cap.so and linux capabilities. I try this: ...
user avatar
1 vote
2 answers
383 views

Difference between file capability and process capability

I am trying to understand POSIX Capabilities. Sometimes, when reading the documentation they refer to file capabilities and sometimes to process capabilities. What is the difference between file and ...
user avatar
  • 261
1 vote
1 answer
3k views

Can you assign Linux capabilities to users?

In Solaris, I believe that you can assign privileges to users. I know that in Linux you can assign capabilities to executable files, but can you also assign capabilities to users?
user avatar
  • 531
6 votes
2 answers
857 views

Does macOS and Solaris have "capabilities"?

Linux have capabilities, which are used to give a non-root process some privileges. Does macOS and Solaris also have capabilities? if not, do they have something similar to capabilities?
user avatar
  • 531
1 vote
3 answers
950 views

Does a process that have the root user always have all of the capabilities available in Linux?

In Linux, a process that have a non-root user can have some capabilities assigned to it to increase its privileges. And a process that have the root user have all of the capabilities available, but ...
user avatar
  • 531
0 votes
0 answers
61 views

Better use ACL or Capability to let users start a service?

My question is openned to other propositions too. An install sequence puts a binary in the directories (say bin1 in PATH_TO_BIN1). It configures a service in /etc/init.d The service has to be ...
user avatar
  • 325
0 votes
1 answer
684 views

Difference between running a process as root and running process with all the linux capabilities

I have a docker container which runs perfectly fine in a kubernetes pod when privileged:true is set in the specification. But when I run the same docker container, by giving all the linux capabilities,...
user avatar
3 votes
1 answer
950 views

Ping not working in a new C container

I've been working on writing my own Linux container from scratch in C. I've borrowed code from several places and put up a basic version with namespaces & cgroups. Basically, I clone a new ...
user avatar